Omer Shlomovits & Ouriel Ohayon: ZenGo – The “Keyless” Crypto Wallet (#306)

Transcript

this is epicenter episode 306 with guests Omer fits and Oriole oh hi on [Music] this episode of epicenter is brought to you by vulture oh the bold hedging platform for the crypto community trade goal to Bitcoin instantly and securely starting at just one milligram go to volt or gold slash epicenter to get early access to the v2 platform and to start trading and buy trail of bits don't leave your project security audit

to just any further trust a team with decades of experience at the forefront of blockchain security research go to trail of bits calm to learn more hi welcome to epicenter my name is sibbeston Cuchillo and my name is frank rain so today we're speaking with or yellow hi on and Omer bits they're the cofounders of Zen go I met them in Tel Aviv I was just in Tel Aviv for the blockchain week there and they are building a really impressive what they call a keyless wallet and we'll go into the details of what that means but effectively they're really revolutionising so the UX and the user experience around wallet onboarding and

well at recovery which as many of you know is a difficult problem to solve yeah I know I mean it was the episode was very technical so that's kind of on the one hand but on the other hand right really it's it's a simple user experience and I think that's one of the things that's really cool is that we're starting to have these like simple and just great user experiences I think there's you know Zen go there's a reason to try to argent on ethereum which is also like that so that's that's really cool so I think that the walls are getting there too when you the next masses enter the space they'll have something that will actually be pleasant to use yes Arjun is another wallet in the space that I've been followed

quite closely I've been using it and but the difference here I make is you know it's good to mention the difference is that argent is a smart contract wallet so it uses on chain Marc contracts to to do sort of multi-sig and social recovery and these sorts of things that you know you one needs in a good user experience for a wallet Zengo is has a different approach they're using advances in cryptography so what we call threshold signature schemes to allow different parties to sign transactions and and so they've got a whole research team they're doing really advanced work in cryptography and multi computations and I think are probably one of the most

competent teams in this space and being in Israel as well you know they have access to some of the world's best cryptographers you know they work I think very closely with a Thai al who's been on the show before and is a professor of Technion so yeah very very good team working on a really good product so I would encourage everybody to try it out yeah absolutely so speaking of Israel you were just in Tel Aviv as you mentioned that to tell you blocks should we carry so we've what are you main takeaways how was surfing so I mean I was there for 10 days about about 10 days yeah so it was a really packed week so there were three conferences overlapping over two weeks so that was scaling Bitcoin ethereal and

star core sessions I mean I'm not gonna go into all of the details of of those three conferences here but I did do a short Anna Rose of the zero knowledge podcast was also there and we sat down actually in the Zengo office and we recorded a short recap of of those three conferences and that will be on YouTube probably midweek so just as this comes out go to our YouTube page and you'll see that that short video I did with Anna we had a high-level I think it was it was really great you know the scaling bakong conference I was kind of pleasantly surprised that there wasn't any of the Twitter tribalism there at least when people meet in person they're quite decent to

each other and the Stork where sessions conference was also really really fantastic they put on a really great event and we definitely have them on at some point so look for it to that on the YouTube channel and also we'll be releasing in the next coming days some bonus content from DAP cons so that was actually like about a month ago but we've received the content from them so the epicenter live episode that we did there will be released to the feed in addition to some other panels so I Sonny did a governance panel and I did a user experience panel so we'll push that out as a bonus episode on the feet and then it's coming days so with that here's our interview with Sango hi we're here with Borriello Heian

and omar slimovitz both of whom are cofounders of zen go hi guys hello thanks for joining us today so we're gonna get to talk about Zen go the product you're building which is a keyless crypto currency wallet we're also going to talk quite in-depth to think about cryptography and some of the new techniques that you're working on specifically multi-party computations and thresholds signature schemes but first let's spend a little bit of time speaking about your backgrounds perhaps with starting with you Oriel you have a background in web 2.0 and previously you co-founded TechCrunch France I believe over 10 years ago how

do you transition into crypto actually I started that wait 1.0 I I saw the year the Internet's you know blue blossoming on our computers and then indeed I saw the birth of web 2.0 with blogs and social networks I had multiple experiences as an entrepreneur one of which is the one you described I was the founder of TechCrunch in France I also worked many years in venture capital both here in Israel countries where I moved 16 years ago and but also in France where I studied venture Thunder and build multiple companies a lot all related to consumer technologies and now

obviously I in cryptocurrency so we're going to talk about that and I've been bouncing back back and forth between the investing so if we flee cryptocurrencies space you know how did you get into that and what appealed to you about the crypto space and specifically the problem of filling a wallet well it was it was very interesting because I've been an early adopter of virtually everything that has been around for the past 20 years except crypto I came very late to the space and I'm ashamed to admit that today because it's not as percent of my time and I wish I did that earlier but I've been building apps for for you know for other platforms for many many years and you know sadly you you really

quickly realize that your business is depending on on the back of others and when I saw the possibility to build apps that could not depend on a dead switch and on only on the platform and to decide whether you should exist or not it was attracting to me and that started to get me excited and curious and very quickly I discovered it was a real revolution not just for apps but for money and Trust and in general anything that we do in the society so I wanted to invest all my time in it quickly I met Omer my co-founder right here and we decided to build this company with two other co-founders and now we're building this crypto wallet which we don't recently and Omer you come from the word world of academia which for longtime

listeners who have followed our podcast for a while probably be aware that Israel has a very vibrant scene in a sort of cryptography space tell us a little bit about your background and you know what's your relation to the broader cryptography scene in Israel yes so I think I kind of naturally into the space starting a few years ago I was doing my PhD supervised by Professor you Delinda by the way I was focused on multi-party computation but I search for what do my own what woke and then I encountered these all concepts of poor folk and

smart contracts and it attracted me it was back in the day where it was easy to follow them everything that is published in the space and special thanks to Stefan the sea Bosque which I think his walking papers kind of inspired me and also Vitalik obviously and again after a furious I met will teach me about his idea the problem of wallet and I was fascinated by it so I just drop everything and join him I think Oriol you had to pull Omer out of his previous start up to get him to join you as an NGO right well he pulled himself great yeah and I think he's a you know

smart guy and to do the opportunity and was just a good timing so on the wallet question what was it about I mean cryptocurrency wallets have been around since you know for a very long time I mean you had initially there you know Bitcoin cutie wall people started doing mobile wallets or certainly hundreds of wallets today why did you guys feel there was a an opportunity or like why focus on that particular aspect of you know all of the different things you could build so just zooming out and the problem that we were really focusing on was private key management which is indeed directly correlated to what wallets are about but not just and when

I stepped into that space I was expecting something that would be you know the level of experience that were I've been used to for the past ten years you know on a mobile smartphone and all these great apps that we've been using developed by other developers and when I what I discovered instead was something that was looking to be honest a bit of a prey story and jump back in terms of what you know user experience means so that was really the first kind of break for me but what I quickly discovered it was not just a user experience issue it was also something that has deep consequences in terms of security and what it means in terms of liability and

you know if the first ten years of crypto have been about trying to become your own bag the episodes and accidents and the hacks have proven that being your own bank comes with a price which is very expensive and sadly that was related to the fact that the solutions in place were just not good enough and I could not imagine blockchain and crypto being a revolution reaching hundreds of millions of users with the same type of experiences and so for me that was the first thing that got me started like identifying this problem that seemed pretty obvious that was actually solved many many times but in such a way that was not really scalable to the for the existence of that

industry I was just not able at that time at least not with that Omer to identify the right technical solution to to build something that would be more appropriate that would be at the same time extremely simple but also extremely secure and all the solutions I could find were either extremely not simple or too secure in a way and that was just something that we thought was very important to work upon no matter how much solutions were coming to the market actually still coming until today so we still think it's early days and that we are still have an opportunity to build something that matters well Brian I have been is based long enough to remember a

time when one had to install armory on an air-gapped laptop and sign transactions on one machine and carry those transactions with the USB stick to another and things have certainly improved a lot since then but I'm happy to know that you guys are working on improving that user experience doing more and I think that that really helps to bring new people into the space I mean like hardware wallets for instance that we're a great step in the way of user adoption and improving a user experience around security but you know as we as we discussed when we were together in Tel Aviv like that's still a long ways away from just being able to you know open an app and use crypto and

have the same types of assurances that you have with something like a hardware wallet where do you see the state of crypto custody today how do you differentiate the different types of wallets you put wallets in classes and and how do you see that sort of broadly actually the analysis web is very simple they are today's wallets with private keys and that's the entire category of the space and this principle forces to a certain type of user experience whether you are on a Hardware wallet on the software wallet on paper one that you have to manage your private key which forces tedious onboarding process recovery process is likely to be prone to

accident to maneuver and hacks and so this is are we looking at the entire space we are bringing something of a different color which requires no capability to be able to handle your private key because there is no private key to handle there is no secret to remember there is no password to store so we call that key less and password less experienced over in the second will explain how we have enabled that technically and there is a lot behind it but the end result is extremely simple and so the space today is really fragmented between solutions that are built around private key has atomic unit of Secrets that you have to manage and

if they get compromised it's game over there is not button called my I forgot my password the reality is that today most people who own crypto prefer to store their phones on exchanges so on centralized solutions because the other alternative is just too painful and so today the vajura key of custody depends on centralized exchanges which also is not great it's another form of poison because you are not in control of your funds if a hack happens everything is gone the insurances that they provide out rest fractional and so they're not good enough and so there is something better that needs to happen and we're trying to bring up this kind of hybrid solution best of both world where at the same

time you are in control you Audion of your phones phones are on chain but there is no typical complexity tediousness associated to embodying the type of solution and we are as a server as a service unable to spend unable to become a point of failure to the user like custodian or exchanges so this is the the new flavor we're bringing to this market the best way to understand is to try it because it's obvious from the first second you trying the app and I think it may be worse today right now to explain a little bit more how this magic is being possible because there's a lot behind it if you're holding a significant portion of

your net worth in crypto you're probably waiting for your aportfolio to moon anytime but holding crypto doesn't mean you should be irresponsible in the face of volatility risk that's where Volterra comes in Volterra is the leading gold hedging solution for the crypto community and as a stable asset trusted for millennia gold is the perfect long-term hedging solution an epicenter we've been using volt row since 2014 to protect a portion of our company's assets against volatility now you might ask why not use a stable coin Seb which is a great point and don't get me wrong stable coins are great and a real benefit for crypto adoption but algorithmic stable coins are still very new and experimental asset type and some asset back stable coins have been scrutinized for being under reserved with Valle Toro your gold is 100% insured and secure it in vaults deep in

the Swiss mountains protected by Brinks every single gram of gold is audited and holdings are made transparently available on their website for anyone to verify and most importantly it's quite literally your gold you can choose to have delivered to you at any time to learn more and to get access to volt arrows brand new v2 platform which includes an interface overhaul and trading in - like coin ether and silver go to Volt or gold slash epicentre that's v-a ult oro gold / epicenter we'd like to thank vulturo for their support of the podcast before we go there though what other companies in the space you put in the same category as n go I would personally put argent for example in that space are

there other any others that you see there I have not seen a lot and doing what we're doing we've seen companies that are using multi-party computation to provide private key solution management we've seen institutional solutions trying to bring this kind of also solution but we nothing anyone had being implemented that way at least none that his cross blockchain and not I know Bitcoin specific or aetherium specific so the Thai users to a specific blockchain or set of features and we haven't seen any definitely none that is using threshold signature and multi-party computation that is we call that consumer grade so I do see though we do see though new generation of

players that are trying to improve the experience with all sorts of ways whether this is by using multisig or smart contract or all sorts of creative ways to do things but you know it's interesting to see these kind of new generations of solution coming so we're gonna get into you know the details I mean right now we talked about keyless wallet probably people have no idea what that means so we're getting to how this is actually done with Sango but before we get in there we wanted to speak a little bit about you know kind of this landscape of cryptographic work and research that you know what you're doing is situated in and of course there's been so much advances where there's

things like it's your knowledge cryptography multi-party computation homomorphic encryption you know in addition to the existing technologies and now you guys are focusing on threshold signatures being able to provide maybe just a little bit of a you know a kind of a landscape and help us to understand where threshold signatures fit in this you know in the kind of overall a space of cryptography cryptography yeah once cryptography has really nice breakthroughs over the last few years and we are focused on the

field of multi-party computation were eventually a set of parties or people want to jointly compute a function any function but in a touchless manual so it's without trusting each other by exposing some private information okay so let's say that we want all of us to compare celery's without exposing the exact amount that we make just we want to see who is the one that is making the most case so this is the function here to dislike a very basic example of MPC now over the MPC has been has been around for a few decades almost forty years now

and it started with like a very basic way of doing it between two parties which was not very efficient and it got better and better until it now we have excellent ways of frameworks that you can do a multi-party computation with any set any number of parties that you can define the setting of how many of them are co-opted there are also four specific functions like digital signatures for example the VIN walks that focus specifically on those problems and came out with excellent solutions that are super efficient on

how to produce the multi-party computation just for this specific type of problems okay so special signatures usually refers to this kind of bucket of solutions on how to do digital signature algorithm with multiple sort of parties in a very efficient way and just over the last couple of years there's been an explosion of explosion of academic papers just around this topic on how you can do it in a way that is applicable to the cryptocurrency and blockchain space now the entire field of MPC is as you said quickly is related to a morphic encryption and also to zero knowledge

poops okay so zero knowledge proof are a tool that is being used in inside multi-party computation usually it's being used when you want to let's say there are two types of adversaries generally speaking in MPC one which we call the semi honest which means that I cannot do anything to change the protocol but maybe given the entire transcript it can deduce all sorts of things mention that would break privacy and there's the malicious adversary which is like maybe Stiller to Byzantine fault systems it's like we do not restrict him and you can do whatever you want and when we are moving for mr. my honest - a

malicious adversary what it means is that basically we need to move along the way to all the computation that everything is done correctly so each step that the party is taking it also involves some zero knowledge proof that shows that this step was done in a correct way without exposing the private information right because in MPC we do not want to reveal the inputs and the ownership of is this property that you are able to prove some statement without exposing the weakness so there again the secret here so this is how easily they are related there's also more involved ways I mean you can also do zero

knowledge poofs now there is based on MPC that's also possible using some technique called MPC in the head now about a mobo freaking crypto so this is a very useful tool also that's being used used extensively in MPC right because again if you think about it MPC allows you to do this kind of secure computation on pilot inputs and oma morphic encryption gives you the gives you a way to do it all right because you are basically manipulating cycle text so no morphic encryption means that you can encrypt so message and then you can manipulate it right so a good example is if you want some database to do some database queries I want to put your your data on a database but you put it in cryptid and then you

still want to be able to get some queries on the encrypted data okay so there also a bunch of companies that are doing this this is a very useful tool in MPC because it's exactly at the tool that we need in many cases to actually perform the NPC to take the cycle text so where all the parties for example can encrypt using this type of a morphic into some type of a morphic encryption their input shares and then you can do the manipulation over the psycho text and eventually you can do some kind of a decryption or distributed accretion and you get a result without our learning the inputs so those are both like would say very useful tools that are used by MPC portables so I guess but what it sounds like you're saying is

that MPC is kind of at the root of a lot of these techniques that we hear of whether it's ckp homomorphic encryption or threshold signatures like they're all rooted in multi-party computations MPC's is a technology now what it's a beautiful technology because it allows you it's an enabler I did it's an enable for entrust this way to getting some results and to do it people from academia along the well the years have used all the tricks that possible in in Catawba fie and zero knowledge proof and morphic encryption are definitely one of the most coolest tricks in the disposal of the photographer protocol designer so

they are used in MPC and it's again it's MPC is very very much it's not new so it exists for for many years now it's a technology that is used and there are different protocols that are doing MPC and each one is utilizing like different types of this kind of cryptographic tricks to achieve this goal cool well thanks so much Homer for giving you so of you I would say let's dive into into the details here so threshold signatures how are they used in Xango can you just walk us through yeah how they use to secure the wallet how they're generated and how they use to sign transactions as well okay so first we need to understand that

threshold signatures or in general a digital signature is actually referring to three protocols three algorithms so the first one is the key generation which allows you to generate the key the secret key in the public key which later can be used to derive public address then you can do there's the second algorithm which is the signing and finally there's the verification which happens on chain this is what the the very far as the miners the validators are doing and in TSS stands for special signatures came the verification algorithm stays the same okay so the magic here is that is how you can generate the signature without exposing

the private key in a specific location but still get the chain to think it's a regular signature so in order to do it you start with this distributed key generation okay so we place the key generation with a distributed key generation what it means is that basically each party will generate a secret the sticker to never leave this party device and using some computation will be able to compute a public key so here if you remember from our to explain about MPC the joint function is the public key and the stickered information is signatures of the secret key so this is the first step afterwards you need another for the call

for threshold signature choose what would eventually output the digital signature regular-looking digital signature okay so it means that a functional to be computed is a digital signature and the inputs are the stickers from the key generation that was the output of the key the key generation state key generation and a few ways that you can use this framework ID because now you have multiple parties that do not necessarily need to trust each other so you introduce an S function into your system which says that you are trusting that some threshold of the parties will behave honestly that they will not get attacked or hacked so this is a new kind of assumption that is not existing in

today's block chains in today block chains you are using only like a very classical public key cryptography assumptions and now all of sudden I'm introducing this threshold assumption so assuming that let's assume that we are fine with this assumption now the question is who who are those parties right to whom I distribute the private key because remember it's not like I'm generating the private key there is no single point in time or there's a single private key so it's not like I'm generating it in a single point and then distributing it I'm doing a computation where the end result is that I have this secret information secret shares generated in a distributed manner to the parties that are doing the computation so one option to do it

is by just doing it over multiple devices that you own so this not what we are doing but this will give you definitely this extra security because now you need it's like a multi-factor signing you need multiple factors to become online depends on your threshold the problem here is that it's very hard to actually do a signing now because you need to actually collect your devices to be online at the same time okay one of the issues with the NPC's this needs this interactivity and you need this they're all devices to be the center so it's kind of a trade-off between the security and the availability the other option is that you can have let's say some servers that will act as parties and they will run the key generation and

signing for you so a set of servers will do it for you now the question is how can you trust those servers so it's true that we introduced this assumption that there is at least threshold honest servers but still who is the one that deployed software to the servers I mean eventually if you go high enough in the channel or in the chain you'll get to this kind of admin or this guy that actually wrote the software ok so it's a single point eventually also those theories eventually like in real life can collude ensign for you on transactions and steve aoki or still owe funds so it's also it's not what we are doing in samples what we are doing stones and hybrid solution where we have only two signatures ok so it's a two-party computation which sounds

simple compared to a multi-party but it's actually not because it's assumed that both party must behave honestly to make a signature which is kind of how demand for a mystic auto call it is what's called dishonest majority because it's enough that one part is misbehaving you need both of them to to act honestly one of the sticker shells will be on the user device on the mobile device the other one would be on our service ok so if you can imagine it it's kind of like a star topology when you have our servers that by the way you can also use NPC or threshold cryptography to maintain our secrets our sticker chests in the stuff that the device is that each one is connected only to us not to

the others and we run a joint computer with him so this is the setting that we are using in here we have kind of joined both words that we give this kind of no single point of failure assumption throughout the system because we started photography we actually build the entire stack or the entire system using this assumption of no single point of failure so it's level agility and also in terms of availability and usability it's easier because you communicate without server and assuming you're testing the authentication you're allowed to do the signing so it's very fast cool thanks so much service that was really a great explanation and so I just wanted to basically kind of rephrase it and provide a brief summary if we contrast

this or something like multi-sig why people will know that and then basically let's say save us you and I we can have a multi-sig on Bitcoin and then you know we both generate signature and then jointly sign this message you know we may have to send it between each other broadcast it and then on the chain it says okay you know both both key signed and it's okay now what you guys here are doing is that the Bitcoin address would look just like a normal Bitcoin address but afterwards we both have a private key and we can basically jointly create this the signature for this Bitcoin address and then we basically have sort of you almost the best of both worlds

right on the one hand we we don't have to hire transaction fees of a multi-sig you don't see on the chain that the multi-sig basically what's almost like a multi snake was used but you have a similar kind of security and of course that model is sort of well known in the in the multi snake paradigm right you have something like bit co or there were other wallets too right where there was a wallet provided to holding one key and me as a user would hold the other key and then jointly we would sign it and now in your example you're doing that but you're using threshold signatures so there's no multi-sig being used but maybe maybe you can talk a little bit so

the how do look at this vs. multi-sig like you see it as one benefit that you can use it on many different chains even when they don't have multi-sig or what are some of the other kind of pros and cons versus multi-sig it's a great question so my claim is that multi-sig is kind of an emulation of a threshold signatures so a threshold signature another way to look at it is the threshold signature is a multi thing that happens in the cryptographic level so it's even before it meets the blockchain you don't need a multi thing is kind of the application level and threshold signature is the cryptographic level so it means that all of the benefits that you mentioned in

terms of privacy of the access structure on the blockchain in terms of the fees that you are paying in terms of the support for other chains that might not allow some kind of multi-sig in the blockchain so this is kind of immediate benefits that that you can can have we for for instance once we had the the threshold signature for Bitcoin it took us like a date to implement it for theorem because it's the same elliptic curve in the same digital signature so it was really it was very fast and formal if it was multi-sig so as you are aware to actually write a multi-state contract contract in a team it's hard it

requires you to do all sorts of today formal verification for the smart contracts many else that can happen so it takes more time now looking at Bitcoin example which is using digital signature which is called ECDSA which is very popular and very old also this is what's used today and that we are hoping that in the future will move to its support also functional type of signatures so it was not very trivial that special signatures got to the point where they are today I can mentioned earlier there was an explosion in threshold ECDSA research just in the past couple of years like something like nine different

particles and the end result is that you have kind of like a mix of protocols that you can choose depending on your reduced case and for example one interesting result that this academic research has led to is I in the sense of the security because like I mentioned multi thing is using the topography of the blockchain which is a classical public key cryptography so the assumptions of the security assumptions are very solid special signatures on the other end or Churchill dcda state specifically was usually assumed some additional assumptions so on the security so you had to compromise in some sense but nowadays there are protocols which are both very fast and

second they are secure in the same security that the blockchain is assuming so you don't need to assume anything more than the security like the existence of some encryption scheme some kind of hardness assumption you can just use the same assumptions I think there's still a buried still room to improvement and I think that the most immediate one is in terms of interactiveness so multi-sig is non-interactive Auto collide so it means that you can stein and then pass it along and someone else will sign and then it will pass the transaction along until you get there enough signatures in is the best signature treasured signature I mean I'm sticking in in in general

because there are some cases where you don't need this interactivity but in general you do need an MPC interactivity so you need that all the parties to be online at the same time and this is something that I think can be avoidable in the specific signature schemes that are used in blockchain and and we have one walk on how to do it but and other there are others that are also doing it and again it's it's a general statement for specific signature schemes and for specific assumptions you can already use kind of a non-interactive threshold signature which will be CDSA for bitcoin big silence yeah yeah yeah I mean I want to bring up the pitfalls we're at CSS falls short with regards to

multi-sig just to repeat what what ever has said there is three benefits too stressful signature compatible to seek the first one is its blockchain agnostic so we can support any Bassets right there's no we're not constrained to the fact that the multi C capability is baked in the protocol built in the protocol and we see the limitation of that for example in etherium with the multiple bugs that have happened and for us it take us really very little time to add another block chain with this way we could support very quickly for example balance chain or or Libre and others will add very very soon the second one is privacy right which because we don't expose the scheme of signatures between the parties

although today we just you know a client and a server but you can imagine in the future we're going to be more the privacy scheme is not exposed and so you know the signature scheme is not exposed and so you're not exposing something that is very sensitive which means which wallets are involved which part is involved in the process of signing and associated to that is the cost of a signature because in a multi sed every time a party sign there is a public signature meaning mining fees associated to it so eventually you end up with something that is at the same time private more private and and much cheaper and also agnostic to any assets so I would say those are the three main properties associated to the fact using CSS over multi C let's talk about

security you know the apps are pretty unique because unlike other types of software they can hold astronomical amounts of value that's why getting systems audited creating robust security processes and fostering a culture of security in your organization is so important and to do this you should only trust experts with real security expertise there are a lot of security firms in the blockchain space but few have the experience and track record of trail fits and they've been in business since 2012 long before things like the Dow hack were even imaginable trail of bits works with your team to audit every aspect of your project and smart contract code is just the beginning they'll help you implement best practices around things like DevOps key storage and user facing applications and

once your software has been rigorously tested and reviewed by trail of bits they'll provide the tools you need to make sure that your code remains safe over every new commit they can even put a software security expert at your team's disposal will give you advice and then your questions when you need them it's like having your own security engineer on staff but don't take my word for it go to their publications repo on github to read their papers presentations and security reviews it's no wonder teams like parody status new cipher and organizations like Facebook and DARPA trust Trello bits for those security audits to learn more go to trail viscom and if you decide to reach out make sure you let them know you heard about them on epicenter we'd like to thank chillip it's for their support I'd like to touch on some of the criticisms of TSS that

we've heard in the space so there is especially in the Bitcoin space people tend to be a little bit more favorable to this other type of signature scheme called noir signatures which apparently have some advantages with regards to like the size of the signature and the efficiency and then also the security some claim that more signatures are more secure because they've been verified whereas TSS on ECDSA has not been sort of formally verified can you walk us through like what are these criticisms and why you think we should trust we should trust threshold signatures today

yeah so let me try to unpack this question and first let me say that like implementing TSS is extremely hard okay it's as we mentioned before it's an advanced form of typography it uses the or knowledge post it uses a mobile fake encryption it's using distributed computing and in general those protocols can tend to be like a multi round and highly and require some high computer some sometimes a lot of computation and eventually this is one aspect that needs to be considered and for example what we are doing so we we've open-sourced all about cryptography and I think this is probably the best decision we've made so

far we get tons of contributions and like butter testing of our libraries and improvements so it's fantastic and I think that this is what makes us because they aren't allowed a lot of TSS implementations out there now TSS I mean what you said about snow compared to TSS we can divide it into several elements so let's first compile TSS with each TDS day which is what's currently used in Bitcoin and a key element and some other leading gap block chains - TSS based on snow so because snow is is a lineal type of digital signature it is much more and

pista friendly than ECDSA this is why we saw those many papers around DC DSA or threshold ECDSA in the last year's and snow it's not trivial but it's easier to do it's like easier to the concepts that are the building blocks of thresholds snow or thought of like many years ago and it's easier to implement okay so there are less risk of being introducing some kind of vulnerabilities when you are doing this type of treasured snow we have by the way both treasured snow signatures and threshold ECDSA libraries so we can definitely compare them whether I can entire walk in breaking Bitcoin about vulnerabilities in

threshold ECDSA because this is very as I said very hard to actually do now having said that let's assume that you have the cryptographer board and and that you are willing to take this risk there are other aspects that might be like a deal breaker but I want to cover them so one of them is about the security of snow versus ECDSA so you know as a polar bear security okay so there's a paper that gives that the entire security proof of snow under a very solid toe gothic assumption zoom the discrete log hardness and in random Oracle model it's not true for ECDSA okay so you see the sa kind of was invented the opposite way so first because of snow because no was pretended there was kind of this invention that

ECDSA should just walk like this and there was the portable and afterwards people started to came up with poof's the level of the security proof on and the assumptions needed just got better and better and I assume that the analysis will keep getting better in ECDSA so like to say that you see this is less secure than snow I would argue that it's it's not very much accurate like EC these days some very solid security proofs by now and also those kind of the the crypto analysis aspect right bitcoin is is a huge but bountiful for finding bugs in ECDSA other block chains as well and also there was like formal efforts to break ECDSA which over they they used did not succeeded there's another issue

with ECDSA which is about mobility mobility is the what it means is that if you can take a signature and then change the signature subjected to still EV and meaning it would be invalid maybe on a different message but without going into the process of least signing it ok now know was proving to be non malleable which is the properties like strong and forge ability so you cannot do this which no this is yesterday the system to be malleable and one of the security proves the dimension show that it's kind of there's one durability which is known which is the sticky the signature and the opposite of part of the signature would still be a valid signature and this is arguably problem but because this is the only male ability and this

is this can be covered so what you've seen the recent papers is that you just need to define one of the two ECDSA signature results to be the acute the one the correct one and this is also what was suggested in bitcoin it was one it's one of the dips and it's also effectively same with like if you say which you kind of eliminate the problem altogether looking at you know on the other end even moving to be non malleable in fact because it's not standardized like ECDSA there's there are many standards for snobs or anyone can just say that take some valiant and this is a tional signature and eventually what can happen is that for example we have a blockchain called silica that have one variant of no

signature and bitcoin no beeps no is another variant and what might happen is that one signature one broke chain would ever meaning in another blockchain which is kind of like the point of nobility so I'm not sure if it's a strong claim to know so to conclude I say the track EC they say is valid is secure to some good extent taking is to the same doing TSST seriously it's definitely harder than doing TSS over lineage snow okay thanks so much all right well let's let's talk a little bit more about just a single wallet use experience oh yeah can you walk us through what's the you know the process of yeah setting up a wallet and

using the Sango wallet so first is going to be how to sound as smart as on / after all those great explanations so I'll try to be to make a point here let's just first like remind I mean I'm sure your audience already knows that but typically when you on bought a new wallet and I will not talk about exchanges which are like centralized service and you just create a login and a password and you know kyc usually but typical non-custodial wallet the experience will be the following you will open it and you will be presented a set of 12 or 24 words you will have to somehow write it down think about mobile first experience where you don't have

the possibility to take side notes or something so you probably will do a screenshot of that which is a very bad idea and although the apps will tell you not to do it and then you will have to repeat some of those words with value that you have them and then at some point you'll get into roughly be wallet some wallet will allow you to skip that face and at some point for example when you buy a new phone you realize you have not backed up and because you have not your your seed oil sea fries with you your money that you thought was here is gone and he's gone forever so that's typically the experience that you would have on normal wallets right so here here is how it works with Xango with

Xango you do not have to memorize any secret the only thing that you know you need to know is your email address the access to your email address so you open Xango will ask you your email address you put your email address you receive magic link which is a bit like slack is doing which is like a way to pass a password without actually revealing a password you click on this email to validate your email you get to the second step which is validating the existence of your device by allowing the permission to your device biometrics whether this is touch ID or face ID and then you get to the wallet at this stage the wallet is set with zero funds and the what is at this

stage not yet backed up so we have made the decision to not force a backup at the onboarding until the owner wants to deposit funds so when you press receive to deposit your first funds you will be forced to do a backup but unlike traditional wallet which ask for you to store 12 or 24 words it works with advanced biometrics which is not the bio mixture of your device but a server-side operating biometrics which we can do thanks to the TSS architecture that we have so here it's very simple for the user all yes to do is to do a kind of live video which is encrypted on its phone of his face right so it's like a face map

that is encrypted on his phone and then the encryption is sent to the server and stopped there in a secured way obviously we cannot read it we cannot see it because it's stored and that's it your wallet is backed up meaning that you have in three steps no password required set up your Xango wallet I did that before and it is a very nice user experience now of course the thing is right so we have this chair or basically this key on the on the my phone and then there's another one on on the Sango server and we just talked about before how that works and now you talked about the back up with these biometrics and I think yagyuu if the backup is right so I

have my iPhone I lose my iPhone at a later point I want to basically recover my share so that I can keep accessing my phones and then I use again this biometric camera can talk to them curious on this point how does that become a work so I've lost my phone I have my new phone I download the Zen go up again and then I'll use this face camera how does it recover and regenerate the share that I originally generate my you know in my previous phone so excellent question so the most important thing is that it works and the second thing is now to understand how it works

so indeed let's say you broke your phone you lost your phone whatever you just bought a new brand new shiny iPhone 11 right which I'm sure you guys have done already if not maybe probably very soon I mean seven all right though you still like using the minitel here anyway you got your new phone with you and you download Django and you go through the same exact steps I described before so you will repeat the same email that you are you have used to create your account you validate it with the magic link you give permission to the Divine's biometrics and you will scan again your face now what it does is remember when

you first scan your your face and it works with any selfie camera so your phone does not have to know to have a special capability you just have any cell phone a selfie camera what it does is that it again scan your face and Cripps it on your phone and then is going to compare it with the encrypted version that we have stored for you and remember it's encrypted so we cannot see it no one can sees it if someone has that file it's completely useless and matches it so as it matches it it restore the share of the of the phone that has been encrypted also and stored with us and it's being restored on the device and then you get access back to

your fans so I know there's been a lot of ping-ponged here between a lot of encryption and mechanisms and security but the simple message is that the face unlocks one of the factors that has been served to encrypt your your private share on your device thought and cryptid on Zongo servers and sent back to your phone as you have restored and so all that is obviously invisible to to the Xango user and restore this fund that of course let's remind very important it's a noncustodial wallet so our fans are on chain just a quick question on that so this kind of puzzles me so if I'm using my

phone with this face thing and you know it basically generates you know some it uses the data for my face when I move it around it generates you some key so this is deterministic I'm gonna do it again with a phone and it's gonna generate the same thing or is there some sort of like similarity and then it roughly matches so basically it's not deterministic it's it's using the learning machine learning model so what it does is basically it encodes your face time for distraction and also it gives you this kind of when you try to authenticate it gives you also a aliveness test all right you see that it's not a picture that it's really like a 3d human being and by the way interesting fact is that you can also

use an MPC this is another use case for NPC because you can I mean some people don't want the face of encoding of their face would be sent to some remote server which is understandable so you can do it over and keep the data so you encrypt your face any to the machine learning over the the encryption of your face that that way this remote server will do the entire process of authentication over the encrypted data like the entire machine learning like getting the those elements from your face and and comparing it to some kind of if it's encoding and all this and will send you the results without knowing like that you are really who you are back in code like keeping a copy of your face so just

to complete on that what's because you know there is a lot of market narrative right now around the capacity to break face ID technologies and defects and all these things so I want to make a few things clear first what these technologies doing is measuring the liveness of your face the fact that your face is alive and real so if you are trying to spoof it with like a picture even of good quality or a video or mask as you showed me at your office Oriol has a 3d printed mask of his face super weird but it doesn't work with that apparently it doesn't it doesn't

work exactly why because the technology is actually measuring the fact that your face is alive so anything that is not that that isn't that you will not pass the test and will we break there and think about it it's the first time the history definitely knows three of crypto maybe in the story of FinTech that you can prove and guarantee that the fans will be only accessible by the owner right because with any other solution anyone was the password is the owner and can spend the money so here you have a solution that for the first time guarantees that only you can spend your own money which is like great to know right no matter what device you have or no matter what secret you suppose you

know so the liveness factor is very important to remember and of course there is a lot of encryption that is done back and forth to guarantee the privacy and security of of the system so that you know the user can confidently use this solution ok so I wanted to address a few things here so this face scanning technique you're leveraging a third party solution I believe it's called zoom if I'm not mistaken and so it's not like the face ID that is used by Apple device or whatever it's it's a separate solution so there are a couple of things that I think are meant to be addressed here so one this is a proprietary solution that you know I

guess you guys are probably paying for or anyway if there's some sort of a business relationship there and so if this solution goes away and all the proprietary intellectual property techniques or whatever that exists there if they also go away what happens to that encrypted key that is encrypting that that's share so that's question number one and my other question is what are the assurances that users have that you because you have the users email address that you're not also share as saving or somehow storing the key that's generated on the device that's meant to secure the the secret share can you address both those issues yes so one principle in the entire angle

system is that there is no single point of failure so what it means in relation to your question is that there is a single point of failure then we cannot guarantee anything if there's another point of failure right there are two points of failure but if there's a single point like for example this third party service biometrics something happens to them so we are still this is a still one factor so we are still left with the main method of extracting the keys from the wallet and we assume that this is still a valid way to do so it's very simple in this way and that way you can just add a bank transaction or recover it using another factor second question was about how can you protect the user that we cannot steal the funds

by pretending to be them so if we analyze this specific scenario of recovery we see that the no at no point in time there is like a single point at all the entire solution okay so the user is iCloud which is something that we cannot access so we assume that it's today it's iCloud tomorrow it's another kind of storage that they use their homes but Zambo is no access to in these Souls one part of the unlocking mechanism like a key or something like this what we have is only a way to authenticate the user based on the biometric information that we are using the this mechanism so in our side

we have an encrypted sticker chair that we cannot do anything with without access to this iCloud or storage of the user and also that the biometric third party company that provides us this solution is only let's say access in the worst case to the actual face but they cannot use it they also don't have access to the iCloud and also two distinct chair that is encrypted on our servers so no one is this in in discussed analysis like access to the entire secret key except for the user that needs to combine his iCloud the fight from the iCloud meaning the access for the iCloud the email that

he owns and his face so only combining those now the server has no way to even if I we had access to the face we still don't have access to the iCloud ok so the secret share which is residing on the device gets backed up encrypted by this key that's generated by the facial recognition software it gets backed up to one's iCloud account or any cloud service perhaps in the future but my question was more around what are the assurances because this is I mean it's essentially a closed source software you know one could say that that's the case for any other

mobile wallet or crypto wallet because you know it's the App Store we don't have access to the source code are there if any any assurances that that secret share isn't being sent over the wire to Zengo or that the encryption key isn't also being sent over the wire are there any assurances at all there or do we have to trust then go that your software is not doing this is the first of all one collection we are not using the face to generate the key and argue that this is very dangerous we are using the strong the strong randomness of the device to generate this pin that encrypts the signature that is later sent to the server and the key is are kept on the device connected iCloud okay

so this is one question now you are touching a very good point right I mean eventually there comes it's all about trust and question is what can you trust and what you cannot trust I mean eventually your device is designed and you're using software for many vendors and the hardware manufacturers and you need to put some trust in them and I think that here it's also you know there's a project about how to minimize the task basing the Bitcoin funneled and eventually you need to think about it like who is writing the full not code so there's a compiler that leads to one you know in order to actually compile who is writing the compiler so there's another copilot and who is writing this compiler eventually this project ends I don't remember the name but aims to get to

that like the minimal trust base that you need and here I think we've done something similar right which will you try to minimize the trust base so eventually right there are some close host elements that I have that would be open group that will be open soon we are doing our efforts to open as much as possible from the system and even if it was completely open-source it's still hard to make sure that eventually what's open sourced and you see it on github is actually used in your application right and it's true for any application that yeah it's actually impossible to do so with a northen app in the App Store or even Google I agree with you that I mean to my knowledge it's impossible to do it it's a great computer science question so what we are trying to do and this is

what we are all about is trying to minimize the trust base that they use the left to trust so again this is a specific scenario of recovery and there's like a huge tree of scenarios for recovery or other stuff that you can do it there and in this specific case you are looking for specific attacks Delphis and we try to do the best to minimize the trust Mexi so what i was saying is that the remember there is open source is never a guarantee of security there is a long track record of open source solutions that have been compromised including in the wallet space so what we've tried to do is as well Merced to be in a more strengthened amaizing environment we have open source entirely our cryptography which has been

reviewed we've run multiple security audits penetration tests they have been made public on our website we have created maybe we'll talk about it about a guaranteed access a solution that is even if we get out of business and stop operating the funds will remain accessible and over time as we progress things will be more transparent more open more distributed more decentralized if we can say we had to start somewhere we're bringing a new flavor and this new favor will blossom off fully over time okay we're not gonna have time to go into this procedure that you've outlined in order in case an NGO goes out of business but I will link to that in the show notes if anybody's interested there

Cinco has a whole process around like what happens if the company ever goes out of business how can one recover their funds so I wanted to ask you about the broader evolution of the wallet space so right now I mean wallets are pretty much compatible so for example you generate a seed on a ledger you can take that seed and move it into electrum and still be able to recover your bitcoins I think you could probably even you know put it in like a multi currency wallet like Jax for example and have access to the whole tree of of HD keys they're accessing giving you access to oh you know funds in different currencies so there's there's interoperability there with something

like Zen go now that we're relying on multi party computations and where there there isn't a standard at the moment do you foresee that different wallets will effectively be different closed ecosystems and users will not have that interoperability or do you see some form of standardization emerging in the space so our bet is that convenience is going to trump principles and that people will value more anything that makes them their life easier as long as a set of core principles are respected and not everyone is security expert or not

everyone as to know that everything is perfectly decentralized as you know there are many many projects that are going to on board very soon a lot of people to the crypto space whether it's telegram whether this is cacao in Asia whether this is possibly maybe even Facebook one day who knows and this type of users not even ask those questions they will need something that just works and that feels crisp and that can be used on a daily basis it is true and you're correct to point to the fact that the users will need to understand that they are in control and they have the proper guarantees and that the security is in a way safe and of quality so it is our job to build that

over time to provide the right foundation of trust the right services around it the right protection mechanism I cannot reveal secret plans already but I can tell you for a fact that a few months from now people will look at xango and we understand why they have an interest to to store their funds with earth versus like a traditional wallet as they exist today and so I think it's still very very early days what we do see from our first users that are trusting us to deposit their fronts and sometimes in very high volumes is that for them the convenience is the primary factor that they have chosen over the rest and this is why by the way the

majority of the funds are still stored in exchanges it's not because they are by design more secure they are by design the opposite they are everything but secure there are traditional point of failures and we've seen that with the with the hacks that have happened recently it's just that they are so convenient they are just easier to use and so as long as the space is still in this current status where non-custodial are less convenient to use and their counterparties people will prefer con stolen solutions and what we're trying to bring here is something that is kind of like I said in introduction best of both worlds where you are still in control your firms are one chain you have guarantees that your funds will be accessible if we stop operating you are

not constrained to a specific assets because a smart contract works for this and doesn't work for that you are not constrained to multi-sig here because it's not baked in other changes just more convenient and you still are in control but you still enjoy the services of a server that is always on and can assist you of course for unloading you for helping you recover do all sorts of wonderful things that a server can done in the wallet space so our our take on that is that the market is evolving the needs are evolving and that we are in a phase where convenient is going to become a lot more important than your core principles of decentralization and security Nadella

but the weight is being revaluated totally just before we wrap up I wanted to talk about and you've touched on this point when it comes to the evolution of the wallet space right so today already we are seeing you know different walls have different kind of specializations and focus so there are a bunch that maybe it's something like insert up or 0 under some helium wallets very much you know fully focused on aetherium and maybe focus on different defy applications there there will be some others that focused on Bitcoin some others are focused on like supporting lots of cryptocurrencies maybe others focused on staking how do you see that space evolving and where do you think

Gengo will fit in this you know larger universe of different wallet providers so the space is definitely very crowded and definitely very noisy we do believe in the future there will be many many many many flavors of what s the same way we have today in our flat first world many many flavors of banks and financial services so it's not going to be a winner winner take it all not even winners tequila's game should be just very very optimized need to make a difference though between like what you mentioned there are companies that are just interfaces and some that our actual wallets meaning managing the private key so some of them are not handling that at

all they are just like pretty cosmetic services and private key management is handled by others we are in both spaces we overlap both and again convenience is what matters so we handle both but we do believe that in the future you will have solutions for every tastes you will if left people will value absolute privacy and control and they will be comfortable with the solution where the under alone their own security as it was the case until today and you will have people will value certain specific chains more than others for doing whatever collectibles or defi and they will be fine with that thing and the where people will value convenience and there

will be a variety of solutions there what we do not see happening is having consumers or investors download 30 wallets and 40 solutions on their mobile phone all around them is just unimaginable and the way we think about Xango is as the remote control of your digital assets so it's truly operating in the cryptocurrency space we operate with Bitcoin aetherium binds Libra to more and more but we are essentially designed for helping consumers and investors managing all their digital assets no matter what they are whether they are cryptocurrencies digital identities title of properties collectibles and all those things and so

we believe in the existence of remote controls and we believe in the simplification of the space I don't know if we will certainly not be the only one to do that but this is how we see the space going also I don't think there will be room for many words that don't have a business model and this is actually sadly the case today most of them depend on third party revenues they don't control so we think there will be of an evolution also in that area yeah so that I think that brings us to our last question which is is around the business model so we haven't talked about that so far at all yeah how do you see that evolving we're different you know possible business models that you will pursue you for a Sangha

so I won't really reveal all the secrets that we are preparing because our route is pretty unconventional but I will give you just some hints about where we're going first like today most wallets are depending on third-party integrations which means that most words do not control the revenues they kind of deriving the revenues from affiliate fees whether this is by generating traffic to exchanges toward word wallet sales or to plug in services like to buy crypto with credit card or loans and stuff like that the reality is that most of those revenues are not enough to sustain the company and a wallet and is not said enough is an extremely expensive operation to handle it's not a lightweight software there is a lot of

things behind the development of security the auditing the maintenance of the platform the support so you need something better for that and so what we want is to launch probably early next year a set of services that will be specific to the way we operate and that will augment experience of the wallet and hopefully those services will provide sustainable revenues revenues that we control that we are able to operate and to perform at scale and I cannot reveal all the details of what they will be right now so let's do another podcast if you want q1 next year and maybe we will have an opportunity to discuss that's more but I can tell you that they will not be dependent on the integration of third-party services okay cool well curious to see what's gonna

come there and yeah certainly I think business models for wallet is a very interesting space and you'll see lots of lots of evolution in that so yeah thanks so much for for joining us it was a pleasure thank you for joining us on this week's episode we released new episodes every week you can find and subscribe to the show on iTunes Spotify YouTube SoundCloud or wherever you listen to podcasts and if you have a Google home or Alexa device you can tell if to listen to the latest episode of the epicenter podcast go to epicenter TV slash subscribe for a full list of places where you can watch and listen while you there be sure to sign up for the newsletter so you get new episodes in your inbox as they're released if you want to interact with us guests or other

podcast listeners you can follow us on twitter and please leave us a review on iTunes helps people find the show and we're always happy to read them well thanks so much and we look forward to being back next week [Music] [Music]